A getter looks harmless. But if it returns a reference to an internal mutable object, every caller now holds a handle on your private state. CWE-375 covers this: sending non-cloned mutable data as a return value, which the calling function may then alter or delete.
It is the mirror image of passing a mutable object into untrusted code. The platforms MITRE lists are Java, C, C++ and C#, and object-oriented code in general.
How it happens
A class keeps a collection or array in a private field, then exposes it directly.
class Session {
private final List<String> scopes = new ArrayList<>();
List<String> getScopes() {
return scopes; // caller gets the real list
}
}
Any caller can run session.getScopes().add("admin"). The field is private, but the object behind it is not protected at all. The class then reads modified data and may break its own rules about what state is valid.
What an attacker gains
MITRE lists access control and integrity as the affected scopes: data can be tampered with by a function that should not have touched it. If the returned object feeds a security decision, such as scopes, roles, allowed hosts or file paths, a caller can change that decision without going through any check.
How to fix it
MITRE gives two implementation mitigations. Declare returned data that should not change as constant or immutable. Or clone all mutable data before returning a reference to it. MITRE calls cloning the preferred mitigation, since the class keeps a valid copy whatever the caller does.
List<String> getScopes() {
return List.copyOf(scopes); // unmodifiable snapshot
}
For arrays, return clone(). In C++, return a const reference or a copy. In C#, return IReadOnlyList backed by a copy or ImmutableList.
How to find it
The record lists no detection methods. A quick review pass works well: grep for getters that return collection, array or date fields directly, then ask what happens if the caller mutates the result.
Quick check
Does making the field private fix this?
No. Private limits who can name the field, not who can mutate the object once a reference escapes.
